chore: bump posthog-js from 1.416.0 to 1.417.1 in /frontend

[dependabot]

Bumps posthog-js from 1.416.0 to 1.417.1.

Release notes

Sourced from posthog-js's releases.

[email protected]

1.417.1

Patch Changes

• #4521 0a0206f Thanks @​marandaneto! - Normalize capture timestamp overrides to equivalent UTC ISO strings in the browser and Node.js SDKs and shared core. (2026-08-14)

• #4523 6230b5b Thanks @​marandaneto! - Prevent swallowed rrweb observer initialization errors from breaking session replay teardown and subsequent recorder restarts. (2026-08-14)

• #4503 eb05237 Thanks @​pauldambra! - fix(dead-clicks): treat visibility and focus changes as liveness signals, not dead-click evidence

  The dead-click detector treated a visibilitychange as evidence a click was dead: it measured Math.abs(clickTimestamp - lastVisibilityChange) and, once that exceeded the threshold, timed the click out as dead. Because it only recorded the tab becoming visible, any click in a session where the tab had ever been backgrounded (median gap ~1 minute) was flagged.

  A visibility or focus change near a click is the opposite — a sign the click did something (it woke/focused the tab, opened a new tab, or opened a new window/popup) — so these signals now only ever suppress a dead click, never cause one:

  • Visibility changes are recorded in both directions (a click that opens a new tab sends the current tab to hidden), and a window focus/blur observer is added, since a click that opens a new window/popup may leave the tab visible and only surface as the current window losing focus.
  • A click within a wake-up/interaction window (1s, wide enough for a real "tab back, then click" gesture) of any such change is suppressed.
  • The visibility signal no longer feeds the dead-marking path at all. $dead_click_visibility_changed_timeout stays in the payload (always false) for shape compatibility, and a new $dead_click_focus_changed_delay_ms is emitted for observability.
  • Visibility/focus changes are now recorded onto each queued candidate the instant they fire (like scroll), instead of being read from a single shared timestamp when the click is checked ~1s later. A click that hides or blurs the tab (opening a new tab/window) suspends that check while the tab is backgrounded; by the time it resumes the tab has usually returned, and the shared timestamp would have been overwritten by that later transition — losing the click-correlated one and wrongly flagging the click dead. Stamping the candidate as the event fires makes delayed hide→show and blur→focus sequences suppress correctly. (2026-08-14)

• Updated dependencies [0a0206f, eb05237]:

  • @​posthog/core@​1.48.1
  • @​posthog/types@​1.404.1

[email protected]

1.417.0

Minor Changes

• #4485 8bc63c3 Thanks @​dustinbyrne! - Default external dependency loading to versioned asset paths with automatic fallback to legacy paths, and add a strict_script_versioning: 'fallback' mode. (2026-08-13)

Patch Changes

• Updated dependencies [8bc63c3]:
  • @​posthog/types@​1.404.0

[email protected]

1.416.1

Patch Changes

• #4443 b2c6830 Thanks @​arnohillen! - Harden the session replay stylesheet inlining budget (inlineStylesheetBudgetRules):
  • The default budget (10,000 rules) moves from the recorder chunk into posthog-js session recording options, so npm-pinned or cached bundles keep their configured override (including 0 to disable) and direct rrweb.record() consumers keep unbounded inlining unless they opt in.
  • Deferred inlining is bounded inside a sheet: a resumable cursor stringifies 200 rules per idle slice and emits a sheet's _cssText atomically, so monolithic sheets no longer produce one long task and partial CSS never reaches the wire.
  • Deferred sheets are flushed synchronously when recording stops and on pagehide; residual failure modes are counted via $sdk_debug_replay_deferred_stylesheets_failed / _abandoned.
  • CSSOM-only styles (insertRule output, adoptedStyleSheets) no longer charge the budget, since deferring <link> sheets buys those pages nothing.
  • Telemetry fixes: full-snapshot duration wraps the whole synchronous task, deferred counts are cumulative per session, new gauges cover non-deferrable rules and idle stringification cost, and duration samples straddling tab suspension are discarded ($sdk_debug_replay_discarded_duration_samples). (2026-08-13)

... (truncated)

Commits

• 6872a1c chore: update versions and lockfile [version bump]
• aba7d55 fix: perf(react-native): useFeatureFlags / useFeatureFlag re-read the full fl...
• 0a0206f fix: normalize SDK timestamps to UTC (#4521)
• eb05237 fix(dead-clicks): treat visibility and focus changes as liveness signals, not...
• 6230b5b fix(replay): recover from observer initialization failures (#4523)
• a4a25fe ci: upgrade React Native plugin in PostHog after releases (#4518)
• e4d64b6 ci: Remove auto-merge from PostHog upgrade workflow (#4519)
• 65c4809 chore: update versions and lockfile [version bump]
• 1030636 fix(rollup): inject chunk ids in-memory in renderChunk for SRI compatibility ...
• 9b41d8a chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)